v0.1: VLAN choreography, packet fixtures, kernel 6.0+ probe fix (PR #5)

[lunarthegrey]

Summary

• Full SPEC §4.7 VLAN choreography in the BPF program: 802.1Q ingress parse + egress push/pop/rewrite driven by a new `vlan_resolve` map, populated from `/proc/net/vlan/config` at attach time.
• Raw-syscall `bpf_prog_test_run` harness + 21 packet-level fixtures covering the no-FIB §9 Phase 1 matrix (deferred from PR v0.1: fast-path BPF program + toolchain + verifier-pass test (PR #3) #3 because aya 0.13.1 doesn't wrap `BPF_PROG_TEST_RUN`).
• Fixes the `EINVAL` failure I saw on Debian 6.1 — bpf_attr trailing-padding bytes from Rust `Default` land in the user buffer as garbage and trip the kernel's `CHECK_ATTR` macro. `mem::zeroed` then field-writes instead.
• Fixes the `Ipv4Hdr::ihl()` misunderstanding that short-circuited every IPv4 path into `pass_complex_header` (network-types returns bytes, not the raw field).

What landed

BPF side

• `tests/common/mod.rs` harness: raw bpf() syscall wrapper for `BPF_PROG_TEST_RUN`, synthetic packet builders for Ethernet + IPv4/TCP + IPv6/TCP, stat-map reader.
• `tests/fixtures.rs`: 21 fixtures covering ARP / IPv4 options, fragments, TTL, allowlist miss / dry-run matched paths / IPv6 ext headers / tagged (VLAN) ingress-parse / jumbo(-ish) payload.
• `bpf/src/maps.rs`: `vlan_resolve` HashMap (`u32 ifindex → VlanResolve{phys_ifindex, vid}`, 256 entries).
• `bpf/src/main.rs`: one-tag 802.1Q ingress parse threads `ingress_vid` (as a u16 sentinel — `Option` tripped the verifier with `R5 !read_ok` during argument spills). Dispatch consults `vlan_resolve` on FIB success, picks effective egress ifindex + expected VID, and runs the §4.7 matrix:
  • untagged in/out → no-op
  • untagged → tagged → push (adjust_head -4, memmove MACs, write TPID + TCI)
  • tagged → untagged → pop (memmove MACs, adjust_head +4)
  • tagged X → tagged X → no-op
  • tagged X → tagged Y → rewrite (TCI in place)
• Push/pop use `core::ptr::copy` per SPEC §4.7's explicit warning — the 6-byte MAC moves overlap with their sources, and the verifier won't catch `copy_nonoverlapping` misuse.

Userspace

• `linux_impl.rs`: `populate_vlan_resolve` reads `/proc/net/vlan/config` at attach time, `if_nametoindex`es each (subif, parent) pair, and inserts into the map. Missing config (no 8021q module) is not an error.

Bug fixes

• bpf_attr trailing padding (`TEST_RUN`, `PROG_LOAD`, `MAP_CREATE`): `mem::zeroed` + field writes instead of `#[derive(Default)]` struct-literal. Root cause of the EINVAL-with-empty-log on kernel 6.0+.
• IPv4 IHL check: `Ipv4Hdr::ihl()` returns bytes (20 for a standard header), not the raw 4-bit IHL field. Compare to 20, not 5.
• Option verifier: switched `ingress_vid` and `egress_vid` to `u16` with `VLAN_NONE = 0` as sentinel. 802.1Q VID 0 is reserved for priority-only tagging anyway.

What's NOT covered

• Byte-level §4.7 push/pop/rewrite output verification. Those paths sit behind a `bpf_fib_lookup` SUCCESS verdict that needs real routes in the running netns — `bpf_prog_test_run` can't fake that. Byte-level tests land with a netns integration harness (follow-up PR).
• True 9K jumbo frames. Need `BPF_F_TEST_XDP_LIVE_FRAMES` (kernel 5.18+). The 3.6K fixture proves the parse/allowlist path doesn't choke on jumbo-ish sizes; 9K waits on the netns harness too.
• Re-promoting `prog_type.` and `helper.` feasibility probes to required. The bpf_attr padding fix should make them work on the test VM; I've left the demotion in place pending your re-run with the PR v0.1: VLAN choreography, packet fixtures, kernel 6.0+ probe fix (PR #5) #5 binary (feel free to promote in a follow-up once confirmed).
• §11.1(a)/(b) and §11.11 empirical probe helpers. Those are EFG-specific runbook tools; deferring to when you have interactive EFG time.

CI

All 5 jobs green. The sudo step now runs 23 real kernel tests (verifier + veth attach + 21 fixtures) through aya + `BPF_PROG_TEST_RUN`. No more silent-stub false-positives.